EUVD-2026-42605
GHSA-cvgj-gr8r-q762
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Single unauthenticated ClientHello reaches the TLS parser (AV:N/AC:L/PR:N/UI:N); impact is a crash only, so C:N/I:N/A:H with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated attacker can send a single crafted ClientHello with an oversized session id length to read past the receive buffer, crashing any HTTPS, MQTTS, or WSS service built on MG_TLS_BUILTIN.
AnalysisAI
Denial of service in Cesanta Mongoose before 7.22 lets a remote, unauthenticated attacker crash any TLS service (HTTPS, MQTTS, or WSS) built on the MG_TLS_BUILTIN stack by sending a single crafted TLS ClientHello whose session_id_len byte is used as an unvalidated buffer index, triggering an out-of-bounds read. The flaw sits in the built-in TLS server handshake function mg_tls_server_recv_hello() and requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trigger is trivial and the issue was disclosed by VulnCheck.
Technical ContextAI
Mongoose is Cesanta's embedded C networking library widely used in IoT and embedded devices to provide HTTP, MQTT and WebSocket servers/clients, including an optional self-contained TLS implementation selected via the MG_TLS_BUILTIN build option (as opposed to linking mbedTLS or OpenSSL). The vulnerability is a CWE-125 out-of-bounds read in the built-in TLS server's ClientHello parser, mg_tls_server_recv_hello(): the single-byte session_id length field from the ClientHello is taken directly from attacker input and used as an index/offset into the receive buffer without bounds-checking it against the actual number of bytes received. Because the legacy TLS session_id length can be as large as 32 (0x20) and is fully attacker-controlled, a value larger than the buffered data causes the parser to read past the end of the receive buffer during handshake processing.
RemediationAI
Vendor-released patch: 7.22 - upgrade the Mongoose library to 7.22 or later and rebuild/redeploy any firmware or service that embeds it (release: https://github.com/cesanta/mongoose/releases/tag/7.22; fixing commit c288ac1f38424ffdd4d2fd5e1893fd4962642db3). Because Mongoose is compiled into products, patching requires a new build and firmware/binary update rather than a package upgrade, so inventory all devices and applications linking it. If you cannot immediately rebuild, the practical compensating control is to switch the TLS backend from MG_TLS_BUILTIN to mbedTLS or OpenSSL (which are not affected by this parser), accepting the added dependency footprint, or to restrict network exposure of the affected HTTPS/MQTTS/WSS ports to trusted networks via firewall/ACLs or a TLS-terminating reverse proxy that validates the handshake - the trade-off being reduced reachability for legitimate remote clients. See the VulnCheck advisory (https://www.vulncheck.com/advisories/cesanta-mongoose-out-of-bounds-read-in-mg-tls-builtin-clienthello-session-id-parsing) for details.
Mongoose ODM for Node.js before version 8.9.5 contains a search injection vulnerability when using $where filters with p
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. Rated crit
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. Rated critical severity (CVSS 9.8), this vu
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. Rated critical severity (CVSS 9.8), this vu
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infin
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Rated critical severity (CVSS 9.1
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OO
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connect
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today